Warlock
| Active
The Warlock ransomware and operator(s) are believed to be attributed to Storm-2603, a China-based threat actor who is also known to have deployed LockBit ransomware. There's also a crossover between victims with Black Basta. Both are RaaS and have a long list of known and unknown affiliates. Having said that, this is possibly an affiliate (likely a cybergroup) of both of those groups. The Alliance & Association would technically be Encryptor Sharing, but this is realistically more of an "Old Affiliate" that created their own ransomware encryptor and operation.
Extension(s): .x2anylock
Victims
53
First Discovered
victim2025-06-11
Last Discovered
victim2025-09-08
Inactive Since
in day(s)6
Avg Delay
between attack and claim32.3 days
Infostealer
for victim with domain45.8%
Known Locations (3)
Target (Available)
Top 5 Activity Sectors
- Technology 12
- Telecommunication 3
- Agriculture and Food Production 2
- Financial Services 2
- Manufacturing 2
Top 5 Countries
-
United States
10
-
Japan
4
-
United Kingdom
3
-
India
2
-
France
2
Heatmap (Available)
Ransom Notes (1)
Tools Used (Not Available)
No tools used available.
Vulnerabilities Exploited (0)
No vulnerabilities exploited available.
TTPs Matrix (0)
No TTPs available.
Negotiation Chats (0)
No negotiation chats available.
YARA Rules (0)
No YARA rules available.
Indicators of Compromise (IoCs) (4)
SHA256
1
TOX
3
Victims (53)
infoniqa.com
Warlock
Discovery Date: 2025-08-18
165g data, including internal documents, financial documents, employee information, CRM database, HR...
gmtaconline
Warlock
Discovery Date: 2025-08-17
Estimated Attack Date: 2025-07-04
Estimated Attack Date: 2025-07-04
The data has been bought by other buyers (not victims)...
orange.com
Warlock
Discovery Date: 2025-08-17
Estimated Attack Date: 2025-08-09
Estimated Attack Date: 2025-08-09
This is only a part of the files and file list. The full set of files needs to be purchased separate...
brightwork.com
Warlock
Discovery Date: 2025-08-17
Estimated Attack Date: 2025-08-09
Estimated Attack Date: 2025-08-09
[AI generated] BrightWork.com is a project management software company that provides solutions for t...
starsalliance.com
Warlock
Discovery Date: 2025-08-17
Estimated Attack Date: 2025-08-06
Estimated Attack Date: 2025-08-06
The data has been purchased by other buyers...
wytechnology.local
Warlock
Discovery Date: 2025-08-17
Estimated Attack Date: 2025-08-07
Estimated Attack Date: 2025-08-07
The data has been purchased by other buyers...
via-optronics
Warlock
Discovery Date: 2025-06-11
Estimated Attack Date: 2025-05-02
Estimated Attack Date: 2025-05-02
[AI generated] Via Optronics is a global technology company that specializes in the production of in...
eira-group
Warlock
Discovery Date: 2025-06-11
Estimated Attack Date: 2025-04-10
Estimated Attack Date: 2025-04-10
[AI generated] N/A...
nipponindiaim
Warlock
Discovery Date: 2025-06-11
Estimated Attack Date: 2025-04-30
Estimated Attack Date: 2025-04-30
[AI generated] Nippon India Mutual Fund (NIMF), previously known as Reliance Mutual Fund, is one of ...
